OpenBSD: Why and How (2016) - <AUTHOR> https://sivers.org/openbsd <comment><USER2> >It's not for beginners.

I don't consider myself a beginner to Unix or computers (I even have a PhD in the damn things), but I do consider myself a fairly inept and inexperienced systems administrator, with no great desire to spend the time to become better, and my needs are fairly basic - just the usual web/shell/IRC/mail server stuff, and other random infrastructure needs that come along for my work. Incidentally, this is exactly why I _prefer_ OpenBSD. Everything is so minimalist, the defaults so sensible, and the documentation so good, that I trust the machines I set up. I have great confidence that I did not overlook something crucial. The OpenBSD http daemon is beautifully simple - too simple for many uses, but perfect for mine. The OpenBSD mail daemon is the _only_ mail daemon I have ever been able to set up from scratch, just from reading the man pages.

I run Linux (NixOS and RHEL) on my desktop and some servers respectively, because of needs that OpenBSD simply does not support (mostly GPU computing). Linux is fine and certainly runs very fast, but OpenBSD is the only operating system I honestly _like_.

<comment><USER3> I would definitely not consider someone who runs NixOS on the desktop inept nor inexperienced.

<comment><USER4> Yes those words are too strong, but NixOS has certainly halted my Linux learning over the last few years :) In terms of configuration it's usually just "some.feature = true". Whereas with Debian, I'd go read a blog and cut'n'paste commands out of it and cross my fingers that they'd perform the correct mutations of my own OS.

</comment></comment></comment><comment> jim-jim-jim >It's not for beginners.

Maybe true, but it's not just for experts either. OpenBSD's unfriendly reputation ensured that I languished in Linux land way longer than I should have, convinced that I was too dumb for anything else.

If you can navigate directory structure, use a package manager, and uncomment lines in config files, you can use OpenBSD. Try it already. It's good.

<comment><USER5> > OpenBSD's unfriendly reputation ensured that I languished in Linux land way > longer than I should have

Funny enough, OpenBSD's unfriendly behavior just had me go back to Linux land after running a FreeNAS server for two years. I got tired of every single help thread I was reading start with "Well you're stupid and you shouldn't do that" in one form or another.

Once Ubuntu got mature ZFS support in mainline, I was out.

<comment><USER6> What does OpenBSD have to do with FreeNAS? Or did you just mean unfriendly behaviour in general.

What I've noticed about the OpenBSD mailing lists is that while people are generally decent and helpful if you show that you put at least some effort into your question, I also see negative responses to the less good questions that are just not needed, and without value.

I still like OpenBSD because it's just a good OS, but I think some people could stand to tune up their filters a bit.

</comment></comment></comment><comment><USER7> Actually, my first UNIX experience was OpenBSD. I must have been around 14 years old or so when I ran an OpenBSD server at home, and use it as a NAT router with PF.

Whenever I couldn't figure something out I'd just read the manpage and go from there. Needless to say I also did a lot of trial and error, but that was mostly due to my own lack of knowledge at the time.

Fast forward to 2019, and at Mailhardener we run a couple OpenBSD instances, mostly because we really like OpenSMTPd. We also run Debian based servers for convenience reasons.

I still wouldn't recommend OpenBSD though, for almost all situations it would make more sense to run a Linux based OS. Whether it being on the desktop or on a server.

<comment><USER8> Some specific reason to not recommend it?

</comment></comment><comment><USER9> > if you're experienced, like to "look under the hood", and prefer software > that does the minimum necessary, OpenBSD is for you.

I've been using Linux as my primary system for 10 years now. Isn't it a bit exaggerated to group all Linux distributions together with ubuntu?

I think of myself as minimalist (arch linux / i3 / tmux / zsh / vim), thus fitting the description, but I'm not convinced by the argument to make the switch. On the contrary, the article feels like I better be ready to donate a lot of money if I want the system to run as I want it to.

> It's uncompromising. It's not a people-pleaser or vendor-pleaser. Linux is > in everything from Android phones to massive supercomputers, so has to > include features for all of them. The OpenBSD developers say no to most > things.

I'm not sure if that's a good thing or not. Doesn't sound very community driven.

The security focus is probably the most interesting part here. I probably had the wrong assumption that most security-focused guys were on Kali linux.

I'll need a bit more nudging to make the jump over.

<comment><USER10> Nor does the article state what the intended target even is.

Typically, UNIX systems was for servers. And that is probably where security matters the most, too. Along with a conservative view on what hardware to support, it sounds an awful lot like a server operating system.

So does the article claim that it is good to run an operating system that targets servers on your desktop or laptop?

<comment><USER11> Historically, I don't think that's the case. It was developed (after its computer game concept) to support online documentation production. Most of its installations were timesharing systems (e.g. Vax) until the workstation era when it developed the workstation/server split. Considering the proliferation of graphical interfaces on Unix in the 80s, it's definitely a desktop OS.

</comment></comment></comment><comment><USER12> As much as I love OpenBSD, it's one of those things that doesn't work for enterprise.

1) Commands have different switches. This is really annoying since you're probably using GNU/Linux at your day job.

2) It doesn't support all the new and fancy container/automation stuff that your colleauge is super stoked about.

3) Most companies haven't even heard about it, which causes certain problems. Example: I was working for a company that had a collaboration with Cisco, and we needed some binary blob in order to provision networking equipment. Getting this to work on OpenBSD was ten times as much work as making it run on Linux.

4) If you share your laptop with anyone, e.g. your wife or your parents when you're on holiday, they'll be a lot happier with Ubuntu.

In a perfect world, everyone would be running OpenBSD, but in the world as it is now, Linux is "better".

<comment><USER13> This reads like a mid-2000's "BSD is dying" slashdot post...

1) GNU extensions aren't always well thought out or standardized. Assuming everywhere is a current GNU userland will break frequently on multiple non- Linux OS's - look up trying to use `awk` on MacOS, which has BSD derived version.

2) Trendy developer conveniences with half-assed security like containers aren't really in line with OpenBSD's goals. If you want isolation, look into chroot, pledge, and unveil.

3) I'd blame Cisco in this case, not OpenBSD.

4) Says who? If a browser works, most people will be happy. The main use case for OpenBSD is network appliances like routers and infrastructure serving.

<comment><USER12> You're right, it is a BSD is dying post, only a decade later.

I agree with everything that you said. In an ideal world, we could all convince our colleagues that Docker and SELinux and Apparmor and such things are crap, and that everyone should be using OpenBSD alternatives. This is nothing but wishful thinking, however.

I wish the industry (and Cisco) would know about OpenBSD and wish to use it, but alas, this is not the case.

Yes, the main use is a fairly narrow part of possible uses, and introducing a whole new OS, package system and command set just because you prefer pf over nftables seems like something most of your colleagues would be a little disgruntled with.

</comment></comment></comment><comment><USER14> I find OpenBSD much easier to manage than most Linuxes, where everything changes every six months for no good reason. Then again, I have 30 years of UNIX experience.

The main reason to avoid it is the limited hardware support, specially for laptops. I wish there were an equivalent of System76 for OpenBSD.

<comment><USER15> Thinkpads are almost the System76 equivalent for OpenBSD? As long as you stay away from nvidia graphics, that is...

<comment><USER16> Having a ThinkPad X230 in daily use with OpenBSD, have to say it's an excellent laptop and everything just works. Even the WAN, which can be turned on using `ifconfig` and is handy in places with no wifi, such as the country house.

</comment></comment></comment><comment><USER17> OpenBSD is often described as "security focused", but this isn't really what its hat is. The key value of OpenBSD is good engineering practice, which ends up leading you to practices like privilege separation (and OS features to facilitate privilege separation) which aren't "security" so much as they are good defensive engineering - you write your software to be correct and not fail; you also write it so that when it fails it can't do much damage; you also write it so that faults crash loudly and hard rather than quietly doing damage, and so on.

</comment><comment><USER18> I like the solidity of openbsd, but I'll defend linux here in two ways. First, the gpl2 license. There was a time when linux was way way ahead in terms of functionality, and in my estimation it was due to the copyleft licensing. It opened a floodgate of pent up demand to establish an open platform on which companies could standardize. Some have said that linux's success was an accident of timing, as the bsd's were hampered by lawsuits at the time, but to my mind the lawsuits made copyleft that much more attractive.

Second, the incredible flexibility of linux allows it to work in so many wildly different applications. It's a monolithic design, but it's so flexible you don't need to worry about it; it can be as narrow or as broad as you want it to be.

</comment><comment><USER19> OpenBSD is very well documented. The kernel and software stack is integrated. They care about security and write a lot of secure stuff used in other systems. There is usually one way of doing things. You do not need StackExchange.

Just try it.

<comment><USER20> Here's the thing though: I use sites like SE a _lot_, primarily because I can usually type my thought into a search engine and then expect a question with hopefully more than one answer. Would the answers be as succinct and accurate as the OpenBSD manpages? Probably not, but at least it gives me an idea and hints as to where I can find more accurate information if I were so inclined (which I'm sometimes not! Sometimes quick & dirty just works)

</comment></comment><comment><USER21> Among the reasons I like OpenBSD is that it tries (hard) to be "secure by default", meaning, that the initial install has had "only 2 remote holes in the default install" since about 1996. Then as I make changes from that default I can consider the implications of each one.

And I appreciate the low likelihood of privilege escalation (I keep seeing those bugs come up for the linux kernel, not for OpenBSD), and pledge/unveil limiting what apps can do to what they normally should do, so that damage by compromised apps can be greatly limited to a given user account or less. And yes, the clarity of documentation (like the excellent FAQs) and predictability of the system.

So basically, I read news all the time about this or that exploit, and I am not in the vulnerable group. But I do think that it took me more work to get set up the way I want, than when I used Debian more, but that work was _very_ well worth it, and even more so when I include my config customizations to various apps that now work just as I want.

One addition to the base system I always make is to change the /etc/profile to set the default umask to 0077 (and other changes for my own convenience etc). I've long wondered why umask 0077 is not the system default. Although after changing it I had to wrap pkg_add in a script ("pa") which sets it back to the original default so that some apps don't get broken during installation for some reason.

Also, it seems worthwhile to choose compatible hardware, or some things might not work.

<comment><USER22> The main issue I've had with any bsd system isn't the system itself but the settings and configurations of packages. Often defaults are different for no other reason than the package creator thought it might be a minor improvement in some way. I'd rather be using a more thoroughly used set of packages. The few times I've used non-Ubuntu based package sources I often find I'm contributing to make it just work. Now I'm not saying that Ubuntu packages are always right but I'd like the authors of the software choose defaults and if they get fixed/changed it happens in a given version on all systems.

<comment><USER21> Yes, there is a tradeoff sometimes between security and convenience, and OpenBSD chooses security by default, and things usually just work. But Ubuntu is probably more convenient/easy for some things (or debian or devuan anyway: I've been burned by ubuntu, and even debian, where devuan seemed to "just work" the most... more tradeoffs always.)

</comment></comment></comment><comment><USER23> I have been running OpenBSD and PF on a PC Engines APU[1] for my gateway router/firewall at home for about 5 years now and the thing is rock solid. I just love the minimalism and simplicity which is likely the source of the incredible stability of the platform. Besides updates or modifying PF rules I have never had to touch the box.

[1] [https://pcengines.ch/apu2.htm](https://pcengines.ch/apu2.htm)

<comment><USER24> Same here, but I have found wireless performance to be subpar. Ended up double-NAT'ing a second APU with Debian to use 802.11. Still plenty happy with OpenBSD though.

</comment></comment><comment><USER25> Strace & procfs are some of my favorite Linux programs. OpenBSD's ktrace & kdump are much more limited in what they can do. Is there anything out there that can provide similar functionality for OpenBSD?

<comment><USER9> > [https://en.wikipedia.org/wiki/Procfs](https://en.wikipedia.org/wiki/Procfs)

procfs isn't a program but a pseudo-filesystem. Are you just meaning to say that the info stored in /proc and displayed by strace is very useful to you? Or am I missing something else?

<comment><USER25> No, you're right. So what on OpenBSD can provide that information in a similarly convenient way?

</comment></comment></comment><comment><USER26> A colleague once told me, "My wife's laptop keeps breaking, but she won't get a new one unless it runs Unix." Over one year ago I installed OpenBSD on a X1 Carbon 5th Gen, installed some software and connected her to her backup disk and router. She has never had a problem and has never had to ask me about anything. OpenBSD is great for beginners to use.

</comment><comment><USER27> Discussed at the time: [https://news.ycombinator.com/item?id=12403655](https://news.ycombinator.com/item?id=12403655)

</comment><comment><USER28> for me OpenBSD is just like (old) macOS for hackers. Everything supposed to work just works consistently.

<comment><USER29> Mac OS, or Mac OS X?

</comment></comment><comment><USER30> I got stuck at finding a web browser that wasn't severely out last time that I tried OpenBSD as a daily driver workstation. This was about two years ago, and it wasn't a definite thing that it could even run Firefox.

Does anybody here know if this issue has been fixed? Having a reliable, up to date, secure web browser (well, as secure as a web browser can be - up to date with the browser's own security updates) was the only thing that was holding me back from using it as a workstation. I had no problem back then using it as a server, but I couldn't justify running OpenBSD on my servers and Debian unstable on my desktop.

<comment><USER31> OpenBSD now has binary packages for -stable, but AFAIK this does not include e.g. Chromium: [https://news.ycombinator.com/item?id=20694338](https://news.ycombinator.com/item?id=20694338).

Running -current does give you up-to-date Firefox and Chromium packages.

<comment><USER30> So to have a browser with the latest security fixes you have to run -current?

<comment><USER21> The latest obsd version (6.6, or the one just before, 6.5) makes package updates easier without running -current. So it probably depends on if that maintainer has kept them current during the release period. I haven't followed that closely to know how much that has been the case.

But see my comments elsewhere in this discussion page for why I value obsd's pledge/unveil browser mods and lack of privilege escalation more important than having the latest browser fixes (which I also value, but relatively less).

</comment></comment></comment></comment><comment><USER32> A similarly passionate talk written for Debian: [https://wiki.debian.org/WhyDebian](https://wiki.debian.org/WhyDebian)

</comment><comment><USER33> > _Everything is rock-solid and just works. Hardware I couldn't get working in > Linux just works on a first try with OpenBSD._

I guess I live in different universe than the author.

</comment><comment><USER34> What is browser/video decoding support like? Can you use Netflix on Firefox/Chrome?

</comment><comment><USER35> Looks indeed like a very developer-oriented OS. Then why still use CVS?

<comment><AUTHOR> git is GPL, which BSD people tend not to like.

I think they're writing a git replacement under the BSD License, though I don't know how progress is going on that.

<comment><USER36> The author of the BSD version, Game of Trees (got), recently did a presentation at EuroBSDCon, and that video is online[1]. It focuses on security and has quite a bit of functionality, including some new things like having multiple working directories from the same repository and even checking out subdirectories from the repository. Looks like progress is going well. It doesn't do network/remote actions, but you can use the normal git binary for pushing and pulling.

[1] [https://www.youtube.com/watch?v=PRIgeouw7-4](https://www.youtube.com/watch?v=PRIgeouw7-4)

<comment><USER37> > having multiple working directories from the same repository

      $ git worktree add ../foo-develop develop</comment></comment></comment></comment>


Ask HN: Startups and health insurance? - <AUTHOR>

Moving to SF to work with static web tech in a startup (netlify.com) is a dream come true.
But one thing that I'm totally unfamiliar with is health insurance. I'm from Denmark and we simply don't have any. So any and all advice is very welcome.
My wife, 7-year-old daughter and I are looking for good insurance, where the deductible isn't huge. Is this possible without going bankrupt before we get started?
I've seen a few of these threads, but all seems to be several years old, so thought I'd make a new one, with Obamacare and whatnot happening in the last few years. <comment><USER2> Best case scenario is that the company you are going to work for has a benefits package that includes health care. If so it should also cover your family as well. You will probably pay a small amount each month out of your pay to subsidize the cost of the policy.

If the company does not offer health insurance you have a couple options. You can signup through a state exchange (cheaper, subsidized by the government with fewer choices for coverage) or directly with the insurance company (more expensive more choices for coverage).

That is it simply put. I don't know how this affects you if you are not a citizen of the US and there may be other options in California specifically. I would check with the company and if they have an HR person them specifically. They should be able to guide you more specifically.

<comment><AUTHOR> Great advice. I am co-founder of the company, so we can make a company insurance (were thinking to do it that way anyhow). But then the question is what plan to get as a company?

<comment><USER2> Never have used them, but have heard good things about them. You may check [http://simplyinsured.com](http://simplyinsured.com) (they are a YC company and I believe active here as well)

<comment><AUTHOR> Thanks Jeff, they look awesome, and a YC startup to boot.</comment></comment></comment></comment>


Client side Glimpse on the server - <AUTHOR> http://getglimpse.com/About

<comment><AUTHOR> check out the demo video <http://www.youtube.com/watch?v=ke8Rw2BGPG0></comment>


Retired Boeing 747 to become testbed for revolutionary new engines - <AUTHOR> https://www.cnn.com/travel/article/rolls-royce-boeing-747-testbed-seattle/index.html <comment><AUTHOR> cool photo - [https://dynaimage.cdn.cnn.com/cnn/q_auto,w_1100,c_fill,g_aut...](https://dynaimage.cdn.cnn.com/cnn/q_auto,w_1100,c_fill,g_auto,h_619,ar_16:9/http%3A%2F%2Fcdn.cnn.com%2Fcnnnext%2Fdam%2Fassets%2F191015120254-rr- flying-testbed-ultrafan.jpg)</comment>


NSA And Google Developing Hardened Android Kernel For Government Communication - <AUTHOR> http://gcn.com/Articles/2011/10/11/AUSA-secure-andriod-kernel-technology.aspx

<comment><USER2> > One is an effort by the White House Communications Office to move the > executive branch from BlackBerry devices to Android-based phones. The reason > is because Android devices with the new kernel can be secured at a higher > clearance level than BlackBerry devices, McCarthy said.

I'm not convinced that people wandering around with Secret-level (or even Confidential/FOUO/LES/SBU) material on a smartphone is the best way to go...

<comment><USER3> It already happens, and in this era it's somewhat impossible for them not to.

One of the pressures here is RIM is Canadian and even so even if the DoS/DoD is running their own BIS servers, there is still some issue with this all running on Canadian software.

I'd actually welcome this work put back into the open source project - a) for peer review and transparency, and b) so that the corporate sector and pro- sumers can benefit from this too.

</comment></comment><comment><USER4> Won't the manufacturers of those phones have to publish the source code?

<comment><USER5> Not if the phones are only used internally. You only have to distribute the code to those who recieve the binaries.

That being said, they may open source it for wider use. The NSA and DoD were responsible for the creation of SELinux.</comment></comment>


Grafana 5.0 Beta - <AUTHOR> http://docs.grafana.org/guides/whats-new-in-v5/ <comment><USER2> > In v5.0 we decided to improve this experience by adding a new active > provisioning system that uses config files. This will make GitOps more > natural as data sources and dashboards can be defined via files that can be > version controlled.

Yay!

For me the best two things of the release: \- dashboard folders \- dashboard provisioning

Keep up with the great work!</comment>


The AWS Outage: The Cloud's Shining Moment - <AUTHOR> http://broadcast.oreilly.com/2011/04/the-aws-outage-the-clouds-shining-moment.html <comment><USER2> This guy is pretty dense to think that his argument is any different for any system. You control your SLA in traditional datacenters by using multiple locations or maybe tier 4 isolation.

Now why would we need to worry about the same things everyone else does that isn't in the cloud? That's right: the cloud doesn't solve these problems. It's not a shining moment. It's just the fact that in these cases you'd have to be an idiot to think the cloud somehow elevates you from this problem.

Now what cloud does give you can be valuable, though sometimes marginal in comparison to problems like having cascading failures outside your control because everyone happens to be sharing the same network or so on. I'm not knocking the cloud as much as I'm knocking people who pretend it's actually elevating computing away from traditional concerns.

</comment><comment><USER3> This weeks outage asks an interesting question regarding hosting providers such as heroku with their "rock-solid ruby platform". I've always taken part of their offering to be that I don't have to think about infrastructure beyond the abstraction that they provide. Perhaps incorrectly I've been under the impression that paying for their service means they will worry about things like redundancy across availability zones or regions leaving me free to just build the app.

I'm a huge fan of heroku so I'm really just trying to clarify, are these services offering to take care of my infrastructure requirements or do I need to think about adding redundancy/failover etc. myself?

edit: <http://www.heroku.com/how/architecture#routing-mesh> is what set my expectations.

<comment><USER4> I think at least part of the point is that the Law of Leaky Abstractions means you always need to think at least somewhat about the infrastructure, just not as much as they do.

</comment></comment><comment><USER5> I don't disagree with the high level points of the article. Amazon itself was humming along nicely during the problems in the eastern AWS region.

Decouple using SQS, SNS. Use ELB to split traffic across regions. Rely on S3 and SimpleDB for robust storage.

I am curious about how much of Amazon's internal systems rely on EBS.

<comment><USER6> ELB will not balance across regions. SimpleDB and SQS are both one region only, just across AZs. Doing stuff across regions has a whole bunch of latency and bandwidth tradeoffs, and so most of the Amazon services are tied to a region.

I suspect Amazon dont use EBS much, avoiding a point of failure, and it is a newer service.

</comment></comment><comment><USER7> While one should always anticipate failure and design around it, it makes no sense to blame the software designer for such a failure. Downtime should be the failure of the one providing the network resource. <http://en.wikipedia.org/wiki/Chewbacca_defense>

</comment><comment><USER8> It's still down for many people... Reddit came up, but that's not everyone. Assembla the SVN/Ticketing system is still down.</comment>


Groupon Said to Seek Funding That May Value It at $3 Billion - <AUTHOR> http://www.businessweek.com/news/2010-11-07/groupon-said-to-seek-funding-that-may-value-it-at-3-billion.html

<comment><USER2> You can't necessarily apply a marginal price to every share of the company.</comment>


Job Interview 2.0 - <AUTHOR> http://thedailywtf.com/Articles/Riddle-Me-An-Interview.aspx <comment><USER2> "Despite the complete absurdity of the design request, and the complete practicality of his answer, the job will go to a candidate who manages to answer the question by designing an extremely overcomplicated solution for a completely non-existent problem. And that candidate will be the same person who designs their software."

Why am I not surprised that Microsoft is credited with coming up with this type of interview?

<comment><USER3> To be fair, I hear Google asks similar questions, and I don't think anyone would argue that Google's software is too complex (at least from a user- interface perspective).

<comment><USER4> these sorts of questions are common all over the place. at bare minimum it's for the interviewer's entertainment

</comment></comment></comment><comment><USER5> 'm not a big fan of "brain teaser" questions, but the logic of this rant isn't very solid. It's a little like complaining that the Olympics are completely stupid and irrelevant because in reality I never need to pole-vault or whatever. Difficult but arbitrary challenges can often be a reasonable gauge of strength and ability.

<comment><USER6> _It's a little like complaining that the Olympics are completely stupid and irrelevant because in reality I never need to pole-vault_

I don't see that at all. It's more like complaining that pole-vaulting would be a stupid and irrelevant way to screen, say, firefighters. Which indeed it would. And that has nothing to do with calling the Olympics themselves irrelevant.

<comment><USER5> Actually, Olympic pole-vaulters would probably make much better fireman than the average person -- think of the strength and determination required to become an Olympic pole-vaulter. Plus they could just pole-vault in and out of burning buildings :)

</comment></comment></comment><comment><USER7> Sure, there's a lot of noise in using brainteasers as a predictor of problem- solving ability; but IMO they do offer some predictive value. It's an opportunity for them to see how you think. They're hiring you to solve problems - and the easiest way for them to gauge problem solving ability is to ask you to solve problems.

"Would you want to work with the guy who builds a water-displacement scale/barge, taxis a 747 to the docks, and then weights the jumbo jet using that, instead of simply calling Boeing in the first place?"

Umm, just because you CAN solve these brainteasers doesn't mean you don't know how to call Boeing! Knowing more than one way to solve a problem is almost never a weakness.

And as for the blind bike example, the candidate was not being practical, just being a pain in the &*%. Just answer the question without being a smart alec.

<comment><USER8> Except brainteasers are vulnerable to prior exposure. Once you've heard enough of them you have a bunch of tools at the ready for any others that use the same kinds of intuitive leaps -- and you may not even need to do that if you get asked ones you already know.

Just pretend you're really trying hard and voila, eventually spout the correct answer you appeared to have thought up on the spot.

<comment><USER9> I hear these little brain teasers and can't help but think of Monty Python's Holy Grail: "What is the air-speed velocity of an unladen swallow?"

Yeah, I'm the guy who would ask "747-300 or 747-400?". Granted it could probably be figured out by taking the vector of the thrust to lift ratio of the engines and wings at take off, but something tells me you'd go through a lot of planes that way rather than designing it with that in mind.

</comment></comment></comment><comment><USER10> I am happy Microsoft has stopped doing that, talking to friends who got internships and jobs there, they mainly stick to programming brianteasers (how would you traverse a node while doing blah blah), and at most design questions (how would you design a red button).</comment>


The 10X Hustler - <AUTHOR> http://soundboy.tumblr.com/post/30041060298/the-10x-hustler <comment><USER2> @OP: your site is utterly UNREADABLE for me! The Inconsolata font looks ugly- to-unreadable on Windows browsers at the font-size you use! (Maybe the Mac OS antialiasing does some wonders or maybe you have Retina display, but PLEASE, either substantially increase the font size or change the font: on Windows machines, Consolas is readable at this font-size, so you can just do `font- family: Consolas, Inconsolata, Monaco, monospace`).

<comment><USER3> I'm on OSX/Chrome21, and it is quite hard to read for me as well. In addition to exploring other font options, I would recommend you play with the `line- height` css property to give the text some breathing room!

In the article "Secret Symphony: The Ultimate Guide to Readable Web Typography" [1] the author covers `line-height`, line width, proportions, and stresses the importance of getting typography right for to your readers. The article then goes into some golden ratio stuff, which may be a little more than you are interested in, but give it a look!

[1]: [http://www.pearsonified.com/2011/12/golden-ratio- typography....](http://www.pearsonified.com/2011/12/golden-ratio- typography.php)

</comment></comment><comment><USER4> For me, Hustler has always had a negative meaning, one I would hesitate to self label, or be proud if someone else gave me the label. I'm sure it was that way for the 'hacker' label for those on the outside looking in before hacker no longer had a negative association.

I'll do my best to keep an open mind on Hustler.

<comment><USER5> _For me, Hustler has always had a negative meaning, one I would hesitate to self label, or be proud if someone else gave me the label. I'm sure it was that way for the 'hacker' label for those on the outside looking in before hacker no longer had a negative association._

It's funny, "hustler" definitely has a couple of meanings in American pop culture that would have negative connotations for most people. To a lot of people, it means something sorta like "con man" or "pool shark" and the connotation involves conning people out of their money. To other people it's synonymous with "drug dealer" which has it's own connotations.

BUT... "hustle" also has a pretty positive association in other contexts. For example, being a fan of (American)football, you often hear players described as "having hustle" which basically means "good work ethic, doesn't loaf on plays, always gives full effort until the whistle, etc."

And now we're seeing this startup related use of the word hustler which, to me, basically means "entrepreneur with hustle" or "entrepreneur who has great work ethic, works his butt off to find a way to achieve his goals, has pigheaded determination, etc." This almost strikes me as combining a bit of the connotations of the "drug dealer" thing with the football player example. Not exactly, but you can see elements of both... Anyway, used in this context, I don't see the problem with "hustler."

<comment><USER4> I had forgotten about the meaning in American sports. That is an outstanding example of the positive use. Thanks for sharing.

</comment></comment></comment><comment><USER6> Engineering is transparent … It is fairly easy to evaluate how good someone is. Are they a good coder? An ubercoder? Things are different with sales. Sales isn't very transparent at all. We are tempted to lump all salespeople in with vacuum cleaner salesmen, but really there is a whole set of gradations. There are amateurs, mediocrities, experts, masters, and even grandmasters. Peter Thiel

<comment><USER7> Not sure I understand this. I think it's very hard for engineers and other Silicon Valley types to evaluate salespeople.

However, in the rest of the business world, a salesperson is about the easiest potential hire to evaluate. Ask them to pitch the product they will be selling and then ask to see their past two year's of W2's with their commissions earnings to see what they've done in the past.

<comment><USER8> May be in part because the parent is paraphrasing, ie, its from another context, and missing the original frame. Worth checking out, though, original discussion i believe is here.

[http://blakemasters.tumblr.com/post/22405055017/peter- thiels...](http://blakemasters.tumblr.com/post/22405055017/peter-thiels- cs183-startup-class-9-notes-essay).

</comment></comment></comment><comment><USER9> I like the way you use that post as a way to recruit the person you just described. But I agree with PaulHoule that the 10x isn't meant just for developers.

<comment><USER10> i thought it was worth a try. one thing i realised when i made a list of people who really fitted this description is that in most cases they came inbound vs being recruited. as a result i've been prepping a series of posts on distribution/partnerships to see if I can get the attention of the white whale.

</comment></comment><comment><USER8> This is a complex subject, and you nailed the 'level of abstraction' nicely in your piece. That's not an easy thing to do.

On a side note, the USV piece you referenced (from 2006 - on bus dev via APIs) was interesting in the context of where Twitter is now.

</comment><comment><USER11> In my experience, somehow everybody in the money chain of posession manages to grab some of it. Never mind the logic; people can't help but wet their beaks. Socially we rationalize it. It doesn't really make any more sense for a sales person to have a commission, than the guy that boxes up the product and mails it.

</comment><comment><USER12> I think this has always been recognized. This is why salespeople get commissions.

<comment><USER13> Why don't developers get commissions then? There are plenty of papers out there showing monetary reward does not improve people's performance. I have no idea how sales should be paid though

<comment><USER14> <http://www.ericsink.com/bos/Closing_the_Gap_Part_1.html>

In sales is relatively easy to measure performance. A sales guy's commisions should be a factor of the value they add to the company based on how much they sold.

Obviously, they'll be slightly loose cannons (lying to get sales), but that's part of the cost of having them.

You could just hire sales guys and not pay them a commission, but ... their intrinsic motivation will be close to zero (would you want to do their job?) and it's too hard to manage them without incentives.</comment></comment></comment>


"The title 'Front-End Developer' is obsolete." - <AUTHOR> https://css-tricks.com/the-title-front-end-developer-is-obsolete/ <comment><USER2> I'm a "Front End Developer" some applications I work on are back end focused, others the logic is heavy on the front... I do almost no UI design type work... Inevitably I work on the back end.

Outside of a large company with very defined roles it really seems like every coding job has the possibility of being "full stack" at some point.</comment>


The Biggest Problem with San Francisco's Rent Crisis - <AUTHOR> http://www.slate.com/articles/business/metropolis/2015/06/san_francisco_rent_crisis_the_solution_isn_t_in_the_city_it_s_in_the_suburbs.html

<comment> anti-shill really important issue...the only entity that can stop this housing crunch is the supreme court</comment>


Ask HN: Firefox now supports web assembly; how do I get started? - <AUTHOR>
 Is there any clear path to writing apps for firefox in web assembly? <comment><USER2> In js/arc/shell subdirectory, build it with DEBUG=1 compile option, and you will get a pure JavaScript interpreter shell complete with assembler and disassembled.</comment>


Ask HN: How do I submit a posting to Hire HN? - <AUTHOR> <comment><USER2> > Can I post a job ad?

Please don't post job ads as submissions to HN.

A regular "Who Is Hiring?" thread appears on the first weekday of each month. Most job ads are welcome there. But only an account called whoishiring is allowed to submit the thread itself. This prevents a race to post it first.

The other kind of job ad is reserved for YC-funded startups. These appear on the front page, but are not stories: they have no vote arrows, points, or comments. They begin part-way down, then fall steadily, and only one should be on the front page at a time.

[https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

<comment><AUTHOR> Yes, this is what I meant. So I would just post as a comment to that thread? They don't need to be submitted in someway beforehand?

<comment><USER2> > So I would just post as a comment to that thread?

Yup!

The post will be something like "HN: Who's Hiring". You just post a comment with some information about your company and what you're looking for.

Good luck!

</comment></comment></comment><comment><USER3> See "Can I post a job ad?" at [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)</comment>


Hello, my name is Czech Republic - <AUTHOR> http://iknowczechia.com/#.UXU3rBJVqtR.facebook

<comment><AUTHOR> Czech Republic is a real place, filled with nice people. They don't deserve to be threatened by ignorant Americans who probably can't even find Rhode Island on a map.</comment>


Clown elected to Brazilian Congress - <AUTHOR> http://www.google.com/hostednews/afp/article/ALeqM5imrl_6qHwYFdPbsqDwBRIX7pD4tA?docId=CNG.9169ad9303e8b3a2ca9470b5e05e2e20.b81

<comment><USER2> This is news? There's a few hundred clowns in the U.S. congress...

<comment><USER3> At least this one is being honest about what he is!</comment></comment>


Top 100 Jobs You Can Elance - <AUTHOR> http://www.elance.com/p/100-projects-outsource.html

<comment><USER2> Each one of these is a niche where you can compete with Elance with your own web app.</comment>


Intel and Micron Produce Breakthrough Memory Technology (x1000 Speed) - <AUTHOR> http://newsroom.intel.com/docs/DOC-6713

<comment><USER2> This could be incredibly interesting in a lot of ways... I wonder how this will affect the likes of database servers that have been highly optimized to treat disk and ram very differently... What kind of boon to memory mapped databases would this be?

I'm guessing that the best initial use cases for this would likely be Amazon, MS, Facebook and Google... I can imagine a server blade that has a low-power CPU, and a TB of XPoint memory with many hundreds to a rack. I would think that on a large scale C* and other bigtable solutions would see incredible gains.

Once other RDBMS are better (de)optimized for such a system, they would see huge gains too.

I don't know that this will leak into personal computing nearly as soon. Low cost is all relative, and even SSDs are still pretty costly when you need several TB of storage compared to HDDs.

</comment><comment><USER3> Is this similar to HP's memrister effort reported in Wired recently? Sounds like it. "Memory with the density of Flash and speed of RAM."

</comment><comment><USER4> It's facinating. This technology can replace DRAM and it means that we could switch from GBs of RAM to TBs in one huge step.

<comment><USER5> They explicitly mention that it CAN'T replace DRAM. It's faster than SSD, but way slower than memory.

<comment><USER4> They explicitly said that it CAN be used both as a storage and a system memory. Indeed it is slower than DRAM, but the difference is relatively small, DRAM is not even twice as fast, according to the provided data DRAM is only 1.5 times faster.

</comment></comment></comment><comment><USER6> Does this have any chance in being put into electronics in the next year?

<comment><USER7> Per this WSJ article [http://www.wsj.com/articles/intel-micron-claim-memory- chip-b...](http://www.wsj.com/articles/intel-micron-claim-memory-chip- breakthrough-1438099234) there will be production of samples later this year, with general sales starting next year.</comment></comment>


Ask HN: Which (if any) anti-virus suite has more advantages than disadvantages - <AUTHOR> <comment><USER2> Windows Defender is the only one that I fully trust. I know that it won't catch everything, but at least it has very few downsides.</comment>


How I got a 100% conversion rate cold calling prospects for customer dev - <AUTHOR> http://whitetailsoftware.com/index.php/2011/07/how-i-got-a-100-conversion-rate-cold-calling-prospects-for-customer-development/ <comment><USER3> I'd consider this a "100% response rate" rather than an aspect of conversion rate. Conversion typically implies sign ups or sales of some form, especially in the context of cold calls.

That said, this information is gold -- I'll use it myself to increase high- priority responses.

<comment><AUTHOR> That is a fair point. I debated about that phrasing specifically, but a friend of mine in outside sales uses 'response rate' for a cold call to simply mean he got to make a pitch.

<comment><USER3> I'd actually still keep the title the same -- I went to this post first and read it from top to bottom because of it :) Talk about conversion!

</comment></comment></comment><comment><USER4> We've used a similar technique - although not very aggressively at <http://row27.com>

We work in sports, and found that although we had 50+ clients in college, the pros were hard to penetrate. So we started <http://rowshow.com> and contacted a few industry leaders to be on. Very quickly that got us our first two pro teams, 1 NBA, and 1 NFL - 100% conversion to sale.

Although after reading this I think we might do it in a more organized fashion, at least after all other contact methods have failed.

</comment><comment><USER5> This isn't a 100% conversion rate. You're investing a lot of time and effort on this and not getting a financial return. It may well help you with prospecting and could even help get you to your initial sale but please see it for the exercise that it is, which is market research, not sales.

I do hope it all works out well for you and that you get some very valuable feedback.

<comment><AUTHOR> I feel like the first bit is an argument over semantics. Does conversion mean I sold something? Does it mean I got someone to perform a desired action?

You're right on the next part. It is a significant time and effort investment. The theory is that I'm saving myself money and time spent developing software no one will use. And the Zen Master said, "We'll See."

Thanks for the encouragement.

<comment><USER6> > Does conversion mean I sold something?

Yes, in the context of cold-calling, that's exactly what it means.

Generally, it means achieving your goal. And while in 100% of your phonecalls you are well on your way of getting to that goal, your goal is getting them to pay for your services, not allowing you to give them another sales-pitch (which is what you achieved).

<comment><AUTHOR> My goal was learning through interviews. I don't have anything to sell. Perhaps in an abstract sense I hope to sell them at some point in the future. I used 'conversion' because I converted them from cold prospects for interviews to interviews.

</comment></comment></comment></comment><comment><USER7> This tactic is actually quite brilliant.

I tried cold calling a few prospects, but I could only get through less than 20. It was brutal.

But now that you have proposed this, I am going to re-think my process and see how I can integrate this.

I think this can work, when done right.

Plus, it can be an awesome source for some good quality blog articles - <USER2> increases SEO traffic on those keywords.

</comment><comment><USER8> So where is the blog with the articles?

</comment><comment><USER9> Simply brilliant! All this time i've been thinking i'd like to write staff scheduling software for cafe's, if only i could make some contacts with cafe owners. This sounds like a great way to make those contacts. Do you mind telling us which blog it is that you've got? Was it important to the prospects that your blog has lots of readers? Also, were the prospects you called in an internet-related industry where linkbacks and blog posts are important to them? Or were they simply bricks and mortar? Thanks

<comment><AUTHOR> The blog in question is fledgling (~ 6 months old). It has little traffic, but is growing quickly. The industry is wildlife management. None of the business owners I spoke with even asked about traffic. They aren't (usually) technically sophisticated.

They typically do have websites and they sell breeder stock wildlife online through different channels. Link backs and online PR can really benefit them and they recognize that.

The business requires acreage, starter animals with recognized genetics/pedigree, and a lot of dirty work.

<comment><USER9> Thanks for letting me know. Sounds like they have a bit more of an online presence than my target, cafe's, and would appreciate the linkbacks/blog coverage more. Having said that, its good to hear that they didn't worry about traffic. Good on you for such a creative, simple, way of networking!

<comment><USER10> Don't promise your cafes links then, promise an article about them.

<comment><AUTHOR> This is a good idea. Promise them reviews on yelp/google/urban spoon. Promise them a write up in a small local paper or neighborhood publication. Get creative.

</comment></comment></comment></comment></comment><comment><USER11> IMHO the OP is misleading in saying he only wants to "know more about <industry>", because he actually wants to turn these people into early customers. Isn't that a way to piss them off? Otherwise maybe the idea is to defer the customer development phase to later, but it seems a waste to find interested people and not having them as customers.

<comment><USER12> If he solves their problems and the become customers why would anyone be pissed off? If it validates his idea it's far more valuable than the time he'd waste developing his concept in a vacuum. Seems like I've read somewhere that if you want to succeed in business you need to be OK with pissing a few people off.

</comment></comment><comment><USER13> This is a really good article.</comment>


Show HN: How I built my self-hosted private cloud - <AUTHOR> https://github.com/technomada/cloud-from-scratch <comment><AUTHOR> I recently decided to make a simple hand built personal private multi-host capable cloud system. I'm really liking how things are going and would like input. What input does the hacker news community have for this project? The intent is to create a repository maintaining contemporary resources for handcrafting and maintaining in a manageable way a personal multi-host capable private cloud system that's accessible internally and externally. P.S. I've found similar projects I'd like to go over in more detail, many of which I looked into briefly but not found in them just what I'm going for, if you're interested in them there's a link to most at the bottom of the git readme. Thanks HN!</comment>


When will blink and marquee come back in fashion? - <AUTHOR> http://www.wtv-zone.com/bluefox/marquee.html

<comment><USER2> the same day netscape "takes over"

<comment><AUTHOR> Firefox was written on top of the netscape codebase wasn't it? So technically it's taking a decent chunk of the market still.</comment></comment>


Snowman: native code to C/C++ decompiler - <AUTHOR> https://derevenets.com/ <comment><USER2> radare2 [1] project is also working on a decompiler, which uses ESIL [2] intermediate language as a source and lifts it to the RadecoIL, whish is then simplified and transformed to C. The missing parts now are mostly Memory SSA, C AST generation (partially done) and Type Inference. The decompiler itself written in Rust and uses the radare2 as a source of ESIL and other metainformation. Using the ESIL as a source will allow to implement the support for a different architectures, not only the common ones. Currently we're running RSoC - Radare Summer of Code [3], and hope that our 2 students will make the significant progress on both Rune (Symbolic Execution on top of ESIL) and Radeco projects. And we are always happy to welcome a new potential contributors to all underlying projects, including radare2 itself. If you want to help us - please join #radare IRC channel or #radare Telegram channel [4]. The sources of Radeco are located at [https://github.com/radare/radeco- lib](https://github.com/radare/radeco-lib)

[1] [http://rada.re](http://rada.re)

[2] [https://radare.gitbooks.io/radare2book/content/disassembling...](https://radare.gitbooks.io/radare2book/content/disassembling/esil.html)

[3] [http://radare.today/posts/RSOC-2017/](http://radare.today/posts/RSOC-2017/)

[4] [https://telegram.me/joinchat/ACR- FkEK2owJSzMUYjt_NQ](https://telegram.me/joinchat/ACR-FkEK2owJSzMUYjt_NQ)

<comment><USER3> I'll preface this by saying that I love radare2. It's my goto tool when I don't need to share work with IDA/Binja users and don't need to decompile something.

The radeco project is a train wreck. The current state of radeco-lib (unless it's been remediated in the last month) is disappointing and the only reason it compiles is because the last SoC student appears to have commented out the bindings that radeco is meant to use to get radeco-lib to do anything. I actually spent an evening attempting to undo that absurd series of commits but after getting a lot of the commented out back in place, not being a Rust programmer, hit roadblocks I did not understand regarding types and traits.

Unsolicited advice incoming. Please keep a close eye on your RSoC students this year. Their goals to achieve anything which they can present do not necessarily grok with the ongoing health of your project. I'd also love it if you would drop Rust and work with a more accessible language, at least while you work toward an initial version which spits out something resembling C code. Ultimately it's your project so do whatever you want but IMHO making everyone understand an inherently complex project in a language which is not straightforward is not the best option. Or at least add some documentation and make your lib and program build together...

</comment></comment><comment><USER4> I'm glad to see a new decompiler, but it looks like it isn't an Optimizing decompiler like Hex Rays yet.

I tested the IDA plugin and it happily gave me very long lines like this:

        esp74 = reinterpret_cast<void*>(reinterpret_cast<int32_t>(__zero_stack_offset()) - 0x104 - 4 - 4 - 4 - 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 + 4 - 4 - 4 + 4 - 4 - 4 + 4 - 4 - 4 + 4 - 4 - 4 + 4 + 20);

Edit:

Furthermore there seem to be some correctness issues, or at least misleading output.

If a string is modified at runtime (for example for obfuscation purposes) then passed as an argument, Snowman will show the original string directly like foo("incorrect", 23), instead of just using an opaque variable like foo(some_var, 23)

<comment><USER5> Looks like it needs a constant folding pass, yep.

</comment></comment><comment><USER5> Another open source decompiler is fcd:

[https://zneak.github.io/fcd/](https://zneak.github.io/fcd/)

I quite like the authors' blog about the development of the decompiler, as it gives a lot of insight into how it works and what academic literature it draws on.

You can also find a video of a talk the author (Felix Cloutier) gave at the Security Open Source workshop:

[https://www.youtube.com/watch?v=h1NP- DV4GVQ](https://www.youtube.com/watch?v=h1NP-DV4GVQ)

</comment><comment><USER6> Sorry for the maybe silly question, but why does one need a decompiler? Isn't it easier to look an disassembly from tools like objdump? The example from the Hello World decompilation does not look significantly more readable to me than a disassembly (with some basic knowledge of assembler).

<comment><USER5> A good decompiler can have a massive impact on the readability of the code. For example, here's a study where the authors found that their decompiler allowed students without reverse engineering expertise to approach the performance of RE experts on some tasks.

[https://net.cs.uni- bonn.de/fileadmin/ag/martini/Staff/yakdan...](https://net.cs.uni- bonn.de/fileadmin/ag/martini/Staff/yakdan/dream_oakland2016.pdf)

Sadly, DREAM++ has never been released open source :(

<comment><USER7> If there's a binary of it, you could use it to decompile itself. A kind of reverse bootstrapping.

<comment><USER5> Sadly there is no binary, only papers. Now, if someone could come up with a technique for automatically creating source code from a PDF description... :D

</comment></comment></comment></comment><comment><USER8> Coincidentally a colleague of mine tried it yesterday and ended up with a better decompilation than hopper. Hopper wouldn't catch a loop and would display it weirdly while Snowman just worked. I've been wondering if binary ninja would have gotten good results, but there is no demo for 64-bit binaries.

Unfortunately for me I'm stuck with Hopper as Snowman is windows only.

<comment><USER9> What do you use a decompiler for? Just for fun, or is it part of your work?

<comment><USER8> For fun :) there is this challenge here that is ending today: [https://github.com/kudelskisecurity/cryptochallenge17/blob/m...](https://github.com/kudelskisecurity/cryptochallenge17/blob/master/README.md)

</comment></comment></comment><comment><USER10> Has anyone tried training a RNN on high level language <-> assembly?

Would be cool if it could even guess variable names from patterns it has seen before, like x,y,z for vector structs.

<comment><USER11> I dunno... If you took a few random textbook physics problems, and replaced all of the nouns and units with arbitrary consistent strings, do you think that it would be possible to tell an electromagnetic problem apart from a plumbing problem? What if the subject is an electric pump?

</comment></comment><comment><USER12> IMHO the "holy grail" of decompilation is to decompile the compiler, compile the decompiled decompiler, and get back a functioning decompiler that can also decompile itself ad infinitum. After several iterations, it may reach a fixed- point... this is essentially the exact opposite of what's customarily done with compilers: compile the compiler with itself, and repeat with the self- compiled compiler until a fixed-point is reached.

Thus, I naturally tried this one on itself, but that didn't work so well --- it spent several minutes analysing, then crashed.

Then I picked something slightly easier, upon which it did manage to decompile successfully, but the output is... not exactly what I expected. Copious void pointers of various levels of indirection (plenty of "three-star-programmer" code...) and reinterpret_cast sprinkled everywhere --- I have the original code and it was written in C, so it amusingly enough decided to automatically convert it to C++, along with the inability to recognise accesses to local variables leading to long sequences of -4-4-4-4+4-4-4+..., mean that for me it's not really all that better than reading the Asm directly.

The latter test was with a binary compiled with a very old compiler, so I suspect something with the newest optimising compilers will produce even more confounding output.

That said, it's great to see plenty of decompilers being written and released publicly; I remember around 2 decades ago when any mention of decompilation would be met with disdain and chants of "that's impossible!" Hex-Rays and IDA may have spurred a lot of this development; but speaking from experience, cracking groups have always written their own private decompiler-ish tools, mainly featuring dataflow analysis.

</comment><comment><USER13> And it has been integrated into the awesome x64dbg for quite a while. :)

<comment><USER14> Huh, that looks a lot like OllyDbg. Do you know how it compares to Olly/IDA/Binja?

<comment><USER13> I guess it wouldn't even exist if OllyDbg x64 would be a (non-alpha) thing. x64dbg provides a number of plugins in order to fill missing features to IDA/Olly: [https://github.com/x64dbg/x64dbg/wiki/Plugins](https://github.com/x64dbg/x64dbg/wiki/Plugins)

<comment><USER15> Looks like a very interesting project, but maybe there's some misunderstandings about the license; from the readme:

> x64dbg is licensed under GPLv3, which means you can freely distribute and/or > modify the source of x64dbg, as long as you share your changes with us.

Should probably read: "... as long as you make genuine offer of providing the source code and changes to those you distribute your version of x64dbg to."

In practice it of course makes sense to upstream changes, but there's nothing in the gpl about that.

<comment><USER16> This is in fact on purpose. Basically I stated my intent of using GPL.

<comment><USER15> That's fine, and it is of course how many projects use the GPL in most cases in practice -- but as it reads in the readme, it sounds like the GPL doesn't [allow] someone to fork the project, port it to say, OS X, or arm - and sell the changed fork to a to a customer without giving the changes back upstream. The porter would have to offer sources to the customer, and the customer would be free to upstream the sources - but from the GPL, there's no legal compulsion to do so.

Anyway, I guess I would have reworded it somewhat, to make it more obvious that the source is under GPL, but that the project welcomes and encourages upstreaming changes. This opposed to the code being under a _modified_ GPL.

</comment></comment></comment></comment></comment></comment><comment><USER17> I would love to see support for this on gobolt.org. It would be really fun to see an optimizer's output expressed as C. For example, you could easily see the results of strength reduction operations, where something like "x / 2" is compiled into "x >> 1".

</comment><comment><USER18> [https://derevenets.com/examples.html](https://derevenets.com/examples.html)

So, a decompiler is cool and all, but...a five-line "Hello World" program turned into a 144-line decompiled program. Is that an accomplishment? I'm pretty sure the "reconstructed" C from that is longer than the assembly.

EDIT: Just to confirm, this is what I got when I put the Hello World code into "hello.c" and ran GCC against it:

      gcc -O2 -S -c hello.c

hello.s:

              .file   "hello.c"
              .section        .rodata.str1.1,"aMS",@progbits,1
      .LC0:
              .string "Hello, World!"
              .text
              .p2align 4,,15
      .globl main
              .type   main, @function
      main:
      .LFB11:
              .cfi_startproc
              subq    $8, %rsp
              .cfi_def_cfa_offset 16
              movl    $.LC0, %edi
              call    puts
              xorl    %eax, %eax
              addq    $8, %rsp
              .cfi_def_cfa_offset 8
              ret
              .cfi_endproc
      .LFE11:
              .size   main, .-main
              .ident  "GCC: (GNU) 4.4.7 20120313 (Red Hat 4.4.7-18)"
              .section        .note.GNU-stack,"",@progbits

<comment><USER5> You haven't linked the program in your assembly example. All the extra code you see there is a result of the libc startup code. Decompilers work starting from then entry point ( _not_ your program's main), which is why there's so much extra code. If you look at just the code starting from main, you get something much simpler:

        int64_t puts = 0x4003e6;

        void func_4003e0(int64_t rdi) {
            goto puts;
        }

        int64_t main() {
            func_4003e0("Hello, World!");
            return 0;
        }

<comment><USER18> Alright, that makes much more sense. Thanks!

</comment></comment></comment><comment><USER19> For those who curious and who is in Berlin:

There is going to be an event on this Thursday (July 27, 2017) where the author of this tool will be talking about decompilation.

[https://www.meetup.com/LLVM-Social- Berlin/events/241197713/](https://www.meetup.com/LLVM-Social- Berlin/events/241197713/)

<comment><USER5> Do you know if this talk will be recorded? I would love to watch but it is a bit far from NYC :)

<comment><USER19> Yes, we are going to record it. But the publishing is up to the speaker. I will post the link here if it happens.

</comment></comment></comment><comment><USER20> From the examples:

int64_t puts = 0x4003e6;

void func_4003e0(int64_t rdi) { goto puts; }

What is this? Is there some compiler that will actually accept this use of goto? Is it just a convention meant for human consumption to translate jump instructions with no translated target? Is it a bug in the decompiler?

<comment><USER21> Strange. Could it be related to labels as values? [https://gcc.gnu.org/onlinedocs/gcc/Labels-as- Values.html](https://gcc.gnu.org/onlinedocs/gcc/Labels-as-Values.html)

</comment></comment><comment><USER22> Could you compile a Go program and then decompile to C? I can see actual uses for that like porting to old OSes.

<comment><USER23> I can see the benefits, but I doubt it would be that simple. The Go code you decompiled would depend on a Go runtime. That specific Go runtime would then have dependencies on OS libraries. So for example, when you open a file in Go, I'd imagine that this functionality is built on top of the file handling functionality of Windows/OSX/Linux. You could work around these dependencies, but it's probably less hassle to port the Go runtime to the new OS.

<comment><USER22> Doesn't the Go runtime get linked in and would just get decompiled? It would generate a huge blob of C but the idea is just to port.

<comment><USER23> Not everything that the program needs to run is included in the binary.

Let's use a more concrete example. Let's say we write a Go program that copies a file. On Windows, this might use an API call like CopyFile:

[https://msdn.microsoft.com/en- us/library/windows/desktop/aa3...](https://msdn.microsoft.com/en- us/library/windows/desktop/aa363851\(v=vs.85\).aspx)

If you decompile the compiled Go program into C, it'd still have the references to API calls like this. These APIs would have to be implemented on the new OS for the decompiled program to work without modification.</comment></comment></comment></comment>


US Army Intelligence – Analysis and Assessment of Gateway Process (1983) [pdf] - <AUTHOR> https://www.cia.gov/library/readingroom/docs/CIA-RDP96-00788R001700210016-5.pdf <comment><USER2> This document is often posted alongside this one about the CIA attempting to remote view the surface of Mars one million years back:

[https://www.cia.gov/library/readingroom/docs/CIA- RDP96-00788...](https://www.cia.gov/library/readingroom/docs/CIA- RDP96-00788R001900760001-9.pdf)

So is this just the type of stuff that the CIA intentionally leaks to throw off foreign governments and make conspiracy theorists look crazier? Or do / did higher-ups at the CIA actually believe it?

<comment><USER3> There are well over 12,000 documents published through FOIA related to the StarGate project(s)[1].

[1] [https://en.wikipedia.org/wiki/Stargate_Project](https://en.wikipedia.org/wiki/Stargate_Project)

</comment></comment><comment><USER4> The "Gateway Experience" referred to in the article was a residential program operated by the Monroe Institute.

It involved listening to audio recordings through headphones while immersed in a sensory deprivation tank. This was claimed to cause synchronization between the brain's hemispheres, leading to altered states of consciousness.

[https://en.wikipedia.org/wiki/Robert_Monroe](https://en.wikipedia.org/wiki/Robert_Monroe)

It seems the Monroe Institute is still offering the program, and has some free audio downloads:

[https://www.monroeinstitute.org/gateway-voyage- audio](https://www.monroeinstitute.org/gateway-voyage-audio)

For the avoidance of all doubt: I have not drunk the Kool Aid. I was just curious about the back story to this article.

</comment><comment><USER5> Note that despite the PDF title and the declassification notes, this document actually came out of US Army Intelligence, not the CIA.

<comment><USER6> Ah thank you! We've updated the title above.

</comment></comment><comment><USER7> To learn where the limit is, you must visit both sides of the limit.

</comment><comment><USER8> Neal Stephenson, not even you could have invented this!

</comment><comment><USER9> Tax dollars at "work". Oy.

<comment><USER10> Hey, this LSD isn't going to experiment on itself, you know.

<comment><USER9> I'd be fine with this paper if it was labeled "Trip Report."</comment></comment></comment>


Enterprise APIs: An Unexpected Bridge from Proprietary to Open - <AUTHOR> https://www.lunchbadger.com/enterprise-apis-an-unexpected-bridge-from-proprietary-to-open/ <comment><USER2> Looking forward to the example...</comment>


Show HN: Content Recommendations Based on What You Tweet About - <AUTHOR> https://www.rallyverse.com/showcase.html

<comment><USER2> (1) What semantic analysis do you use?

(2) The 'follow @Ralleyverse' move is scumbaggy imho, I clicked 'sign me up' but quickly noticed it before the next page loaded. Scumbag move.

(3) It's taking quite a long while ... might edit this post when it works

edit: Results were meh, but that's probably because I rarely tweet anyway. Cool app to use once, but maybe start thinking about ways to have people use it more than once?

<comment><AUTHOR> Thanks rainymood, not really scumbagging, it was more of we can DM you if you request a demo, I tried to make it obvious by putting it right under the auth button. Any suggestions? We also just added an input where you can just use the handle unstead of auth'ing. Yea we definitely rely on your tweets, we see what you talk about and suggest content based on that. This isn't meant to be used more then once really, but that's a great point, we should link to the actual product page. Thanks again for the feedback rainy!

</comment></comment><comment><USER3> I'm on Safari, so I don't know if that changes anything, but the UI is broken to the point of being unusable. I can't seem to click through any of my results to actual articles, and the scrolling is VERY broken.

<comment><AUTHOR> Thanks bfstein, what version of safari, I'm running it fine on my computer, mac Safari 6.2.5. I'll get this fixed as soon as you let me know. Thanks for checking it out.

</comment></comment><comment><AUTHOR> Try out HN, tell me what you think!</comment>


Why cigarette packs matter - <AUTHOR> http://www.badscience.net/2011/03/why-cigarette-packs-matter/

<comment><USER2> The thing I find interesting is the FDA's blatant hostility towards electronic cigarettes despite their demonstrated health benefits over ordinary cigarettes (light or otherwise). [1] [2] Electronic cigarettes simply vaporize nicotine and deliver the nicotine straight to the user with at most trace amounts of tar and carcinogens. A number of studies and at least one meta-study [3] have all found that electronic cigarettes are much safer (for real humans, not smoking machines), and that smokers can quit more easily using electronic cigarettes than with nicotine patches or gum. Why this agency, which is entrusted with protecting the public health, is hell-bent on keeping smokers on regular cigarettes rather than their safer alternative is beyond me.

[1] [http://articles.latimes.com/2010/sep/10/science/la-sci-e- cig...](http://articles.latimes.com/2010/sep/10/science/la-sci-e- cigs-20100910)

[2] www.hsph.harvard.edu/centers-institutes/population- development/files/article.jphp.pdf

[3] <http://www.biomedcentral.com/1741-7015/7/36/abstract>

<comment><USER3> There's definite unfounded, likely highly-funded, hostility towards them. There is a _single_ legitimate cause for concern that I've heard them occasionally mention, however: there haven't been any / many health studies on inhaling _nicotine_ , and what it does to your lungs. Only smoking things which contain it. It's essentially an unknown, so there's definite reason for pause before they _approve_ it... but yes, _phenomenally_ excessive.

<comment><USER4> There has been a lot of studies confirming the safety of snus, and they are just as hostile to it as anything. I don't think they would change their tune even if there were plenty of studies.

</comment></comment></comment><comment><USER5> Australia is great in regards to cigarettes. On all packets, it shows gruesome images of what happens to you if you smoke, all labels are black with a standardised white text, so no brand recognition. They're all behind a blacked out cabinet too.

See: [http://www.google.com.au/images?q=australian+cigarette+packa...](http://www.google.com.au/images?q=australian+cigarette+packages&um=1&ie=UTF-8&source=og&sa=N&hl=en&tab=wi&biw=1440&bih=722)

<comment><USER6> Man, you would think that almost ghoulish imagery in the URL you posted would keep people from buying cigarettes, but I imagine people still buy them in droves nonetheless. I like that at least the Australian government doesn't cave to the Tobacco companies.

<comment><USER7> Addiction's a bitch. I don't smoke but I tend to eat too much with predictable consequences I know full well about. It is possible for me to keep my eating in control (I have for nearly six months now and am very proud of that) but that demands tons of strong, strong, strong willpower. It's exhausting and I will have to keep that will strong for the rest of my life.

<comment><USER8> A bit offtopic but overeating depends a lot on types of food you consume. Removing hunger inflicting components from your diet may make not overeating a matter of habit rather than of willpower.

May have a look here: <http://www.paleonu.com/get-started/>

Has been helpful for me.

<comment><USER7> Changing my diet helps a bit. (It keeps my weight more or less constant if I'm really strict about it. At the moment I still want to lose weight, though.) But since I do actually love eating pasta changing my diet in such a way also requires a lot of constant willpower. I don't see a lot of difference to plain old calorie counting. I try to do both, though – eat healthier and different things (with the occasional pasta day to keep me happy) and count calories.

Counting calories and constant monitoring (for rewards) are the two cornerstones of my current weight loss (and it works) but I very much try to sneak a better diet in and I also really should start doing more sports.

</comment></comment></comment></comment></comment><comment><USER9> Somehow I doubt that the packaging really influences what someone smokes and how much they smoke of it. People make decisions based on taste, strength and habit more than they do on marketing and especially pack design.

If someone's smoking, they've already made the decision to do it, health consequences be damned. I doubt that warning labels, gross pictures or any other kind of package manipulation has a significant effect.

<comment><USER10> Yes, smokers smoke despite knowing full well how bad it is for them, more or less. Gross pictures won't make them stop for the most part. It might make a kid think twice - IIRC it mostly made poeple want to collect them all. Plenty of people bought certain brands just because of how the pack looks - it's branding and packaging like anything else.

The primary goal in anti-smoking campaigns is to stop young people from starting in the first place - over time that's the best money spent.

Take a look at the British Columbia anti-smoking campaigns - lowest rate of new smokers in north america (IIRC).

Tobacco can't sponsor events. No more Benson & Hedges symphony of fire fireworks competition in Vancouver - now it's sponsored by a bank or something.

Stores that sell cigarettes (grocery stores, corner stores, 7-11, etc) can't have them visible to the customers in any way, and can't advertise the fact that they sell them. Basically their marketing was nipped in the bud. They can sell them, but no advertising of any kind)

And you know what? it works.

Then you reach a critical mass where there are enough people NOT smoking that it's just not cool to smoke....

that was after no smoking in bars, restaurants, any indoor public places, within X feet of the door of any store, etc......

<comment><USER11> "Stores that sell cigarettes (grocery stores, corner stores, 7-11, etc) can't have them visible to the customers in any way, and can't advertise the fact that they sell them."

I was curious about this, because I live in BC and realized that I hadn't seen cigarettes in a store for a long time. I'm a non-smoker, but growing up gas stations and pharmacies always had the big glass case behind the counter full of cigarettes, and it recently its seemed odd that they weren't there anymore. So I looked it up, and they're only allowed a small, plain sign with no brands or graphics, just kinds of tobacco and prices. In hindsight, I remember seeing those in one or two places, but I'd assumed it was just store policy.

It does seem to work. I think I've run across a handful of smokers at my university in three years, and many of them I only knew were smokers because they stank so much. Definitely not cool to smoke around these parts. Right now the university has just restricted the allowed smoking areas even further, and unlike when the government smoking restrictions came in, nobody really cares. This is a student body that half consists of people who hold protests over every political concern, and half 'apolitical' people who complain at length about every new fee or university restriction, so when nobody cares about a change that really says something.

<comment><USER10> Yeah - I dont' live there anymore but on one trip back I noticed (I don't smoke either) that every place that had over-counter cigarettes now had it covered over.

It's been a wildly successful effort with long term benefits for the province.

</comment></comment></comment></comment><comment><USER12> Nice to see ben goldacre's writings up on here. He is a clinical epistemologist by training but he has rapidly moved into the world of science journalism (or perhaps meta-journalism) due to his popularity as a writer and speaker.

<comment><USER13> He also has a secondary blog where he posts "things that are too long to post on twitter and not clever enough to post on his main blog": <http://bengoldacre.posterous.com/>

</comment></comment><comment><USER14> I propose: that by law every one in a thousand cigarettes sold should have something that tastes and smells really spit-and-gag foul (but isn't poisonous) inserted at a random point (not just at the tip, or the end, but unpredictably). Light, mild, silver, one brand or another - there is no difference. You have a chance of running into the disincentive whichever you choose.

</comment><comment><USER15> So use of lighter colours and white packaging a la Marlboro 'Lights', as they were known here until recently, is taken objectively to be a Bad Thing.

Why isn't anybody asking, then, on what grounds we think that replacing all cigarette packaging with plain white boxes wouldn't make things _worse_ ?

</comment><comment><USER16> Oh come on.

You can't translate these studies into real world results at all. If you hand people two cigarette packs and say "which one looks healthier," sure, they're going to pick one. They might even pick one over the other pretty consistently.

This does not necessarily translate into real world consequences at all. You have to prove that.

</comment><comment><USER17> I assume the same thing is going to happen to the other social drug of choice?

All those enticing pictures of Chateaus are going to be replaced by a plain white bottle and a picture of a car crash caused by drunk driver?</comment>


Mattel casts NASA Curiosity rover die with new Hot Wheels toy - <AUTHOR> http://www.engadget.com/2012/08/02/mattel-hot-wheels-nasa-curiosity-rover/ <comment><USER2> Interesting, but it doesn't have the strange 6-wheel suspension of a real rover. Not only does the suspension have 6 wheels, but I understand there's a differential inside linking left and right sides, so the body of the rover rotates (in pitch) only half the angular displacement between the two sides of the suspension.</comment>


NSA Spying Row Ushers in Debate Over Big Data - <AUTHOR> http://www.bloomberg.com/news/2013-07-25/nsa-spying-row-in-congress-ushers-in-debate-over-big-data.html

<comment><AUTHOR> This kind of thing could encourage privacy advocates to go after the private sector about big data practices. It could turn into a big problem for some companies.</comment>


Tip: make Slack less stressful by changing theme so alerts are green not red - <AUTHOR> There are other themes under settings -> sidebar. <comment><USER2> This brings about an interesting question about signalling in different cultures. In the Western world 'green' generally means 'up' or 'positive' whereas 'red' signifies 'down' or 'negative'. In many Asian cultures, China in particular, it's the other way round.

Therefore it's quite funny when Western media talk about stock market declines in China and in that context regularly display stock photos that show all stocks in the red.

I'm not sure if this applies to notifications, too ('green' meaning 'positive' and 'red' meaning 'negative' or 'urgent') but it's certainly something to keep in mind when designing an application that's intended to be used by people from different cultures.

</comment><comment><USER3> Color = Standards => [https://xkcd.com/927/](https://xkcd.com/927/)</comment>


Opa: one language for all the web app stack - <AUTHOR> http://opalang.org/ just found this: seems really promising <comment><USER2> Any example apps more complex than typical hello world stuff? I'm interested

<comment><USER3> We'll publish some in the days&weeks to come. There are also a few additional details at [http://dutherenverseauborddelatable.wordpress.com/2011/05/23...](http://dutherenverseauborddelatable.wordpress.com/2011/05/23/unbreaking- scalable-web-development-one-loc-at-a-time)

</comment></comment><comment><USER4> The language looks kind of bloated PHP3 with some ajax, no separation of concerns at all ! I don't think Opa is the solution to the actuals web development problems. Perhaps we need more great ideas and frameworks (symfony, rails, etc) from already well established languages and methods.

<comment><USER3> Separation of concerns is definitely possible. Of course, it's a tad difficult to demonstrate it on 20 loc, but we'll post longer examples, too.

</comment></comment><comment><AUTHOR> i'm reading the manual right now (<http://opalang.org/public/book_opa.pdf>), it is a lengthy pdf that also features a wiki, advanced chat, web service client and server and a reference of the language.

</comment><comment><USER5> I don't know. I see it comes with it's own server and database bundled and I don't really like it. I'd like to choose which server I'm going to deploy and which db I'm going to use myself. Also, the language just looks kind of crowded.

<comment><USER3> > Also, the language just looks kind of crowded.

Would you care to elaborate? Feedback is my second name :) (well, firstname.lastname@example.com is my second e-mail address).

<comment><USER5> Certainly. The language looks crowded to me because it looks like a mixture of several different languages at once (well, two at least).

You're using a markup language to define the user interface - why? If the point was to make it look more familiar to web developers then why not just let them use HTML (as in, HTML separated in it's own document)? I know, the idea of Opa is to be one language to develop the whole stack, but what you get here is an incosistent look of your language. If you're going to let the developers define GUI along with the rest of your logic, it would be much better if it was done in a consistent way.

On the other hand, one could argue that an XML-like language is better for GUI development because it lends itself naturally to hierarchical structures (which a GUI certainly is). And I can actually agree with this. But in that case, I would definitely keep it separated from the rest of the code. Maybe this is just me, but I prefer the concept of separation of presentation and logic.

Usually, one of the best things a web company can do is to not make their developers wear the hat of a web designer, but instead hire an actual web designer who knows her job and who can create a great GUI. But I get the feeling that this person would be very confused if she had to work with Opa. Let the designers work with what they know best, HTML and CSS, and let the developers work on creating a logic behind this presentation layer.

So, I hope this comment clarified a bit what I meant when I said that Opa looks crowded. Of course, these are only my personal views and preferences and are meant as constructive criticism.

<comment><USER3> > On the other hand, one could argue that an XML-like language is better for > GUI development because it lends itself naturally to hierarchical structures > (which a GUI certainly is). And I can actually agree with this. But in that > case, I would definitely keep it separated from the rest of the code. Maybe > this is just me, but I prefer the concept of separation of presentation and > logic.

Good point. Fortunately, that's a feature we have (and use daily). A bit harder to present in 20 loc, but we'll work out something.

Thanks for the feedback.

<comment><USER5> No problem. I wish you all the best in further development of Opa!</comment></comment></comment></comment></comment>


I Eat for Free in NYC Using Python, Automation, AI, and Instagram - <AUTHOR> https://medium.com/%40chrisbuetti/how-i-eat-for-free-in-nyc-using-python-automation-artificial-intelligence-and-instagram-a5ed8a1e2a10 <comment><USER2> Dupe.

Submitted 13 days ago[0] with no discussion. Then submitted again[1] 20 hours ago, getting nearly 200 points and 134 comments.

[0] [https://news.ycombinator.com/item?id=19447787](https://news.ycombinator.com/item?id=19447787)

[1] [https://news.ycombinator.com/item?id=19554425](https://news.ycombinator.com/item?id=19554425)</comment>


Persistence in Varnish - <AUTHOR> https://www.varnish-software.com/blog/persistence-varnish

<comment><AUTHOR> and in other news: varnish 3.0.3rc1 has been released.

[https://www.varnish-cache.org/lists/pipermail/varnish- misc/2...](https://www.varnish-cache.org/lists/pipermail/varnish- misc/2012-June/022090.html)</comment>


Ask HN: (Yet Another) HN Comment Quality Going Down? - <AUTHOR>

I know I know, another thread about comment quality - seems like we have these on a quarterly basis.
But it really does seem bad lately. A lot of up votes for reddit-style one liner zingers. Thoughtful discussion hard to navigate. I find myself losing interest a little bit in the comments section lately, but the submissions at least seem all on target.
I'm wondering does anyone else notice a similar slip in comment quality lately? Is this inevitable? Is there a desire amongst the community to turn it around? Is it just me? <comment><USER2> It's my fault and people like me.

Reddit's quality has been dipping significantly lately (there's been 3-5 front page self posts on "are you smart but too lazy to do anything with it?") and so people like me are subscribing to HN again to get that 'old reddit' feel.

Keep the focus on immediate actionable steps rather than armchair pontificating and you'll drive off the non-constructive layabouts.

</comment><comment><USER3> It'd be fairly straightforward for a browser plugin to hide according to a threshold (+ some rules). eg 1 point comments have to be more than 1 hour old to hit the threshold.

</comment><comment><USER4> edw519 already noted once that it is cyclic, and that the cycles have their 'lows' when YC has their application round, we're in the midst of that.

</comment><comment><USER5> Two suggestions: make votes cost (e.g. 1/10 point); put a threshold also on upvoting (e.g. 10 or 20 points).

Eroding over time (e.g. 1 pt/day) probably would also be beneficial.

<comment><USER6> I think threshold are useless in HN, since submission Karma and Comment Karma are mixed. Send two good stories that you steal from Reddit or track a popular blog and you'll get 100+ points quickly.</comment></comment>


Microsoft acquires keyboard app SwiftKey for $250m - <AUTHOR> http://www.ft.com/cms/s/0/f86534c6-c9fa-11e5-be0b-b7ece4e953a0.html <comment><USER2> Weird. I've used Microsoft's homegrown Swype equivalent a bunch, and it seems just as good. Is this an acquihire, or patent-related?

</comment><comment><USER3> previous discussion

[https://news.ycombinator.com/item?id=11023720](https://news.ycombinator.com/item?id=11023720)</comment>


Stock Market's Slide Is Flashing a Warning About the Economy - <AUTHOR> https://www.nytimes.com/2018/11/20/business/stock-market-drop-economy.html <comment><USER2> Looking at graphs of the DJI [1] for various timeframes over the past 5 years makes me think NTY is crying wolf.

1\. [https://www.google.com/search?sa=X&tbm=fin&q=INDEXDJX:+.DJI&...](https://www.google.com/search?sa=X&tbm=fin&q=INDEXDJX:+.DJI&stick=H4sIAAAAAAAAAONgecRozC3w8sc9YSmtSWtOXmNU4eIKzsgvd80rySypFBLjYoOyeKS4uDj0c_UNkgsry3kAQ0pLYDgAAAA&ved=0ahUKEwiWsN2D2OTeAhURA6wKHWzkDFsQ0uIBCKQBMBE&biw=1770&bih=948#scso=_VOT0W_LbIpK6tgWkr5HgDQ2:0)</comment>